Find chapters in your area

The Compliance Risks of I-9 Software

Members may download one copy of our sample forms and templates for your personal use within your organization. Please note that all such forms and policies should be reviewed by your legal counsel for compliance with applicable law, and should be modified to suit your organization’s culture, industry, and practices. Neither members nor non-members may reproduce such samples in any other way (e.g., to republish in a book or use for a commercial purpose) without SHRM’s permission. To request permission for specific items, click on the “reuse permissions” button on the page where you find the item.

Page Image

Image Caption

​Illustration by Michael Korfhage for HR Magazine

Page Content

The use of I-9 software is becoming
more prevalent among companies large and small, since these systems present an
attractive alternative to paper-based processes for HR departments looking to
streamline compliance with complex government regulations. In addition to
eliminating the need for voluminous files that can be difficult to manage,
store and internally audit, automated systems can:

Ensure greater consistency in
completing forms.

Provide embedded controls that prevent
forms from being entered into the system with missing or incorrect information.

However, not all I-9 software meets
federal regulations. And the problem is that U.S. Immigration and Customs Enforcement (ICE) rulings hold an employer liable for the faults of the
software vendor if its technology fails to comply with the law. That’s why it
is incumbent on HR professionals to choose an automated system that prevents
errors and minimizes the risk of noncompliance.

Integrity Issues

The products offered for I-9
administration come in many forms, from stand-alone Form I-9 and E-Verify
platforms to add-ons for existing HR information systems. Before selecting an
I-9 system or add-on, carefully weigh the benefits gained from workflow
efficiencies against any compliance issues to avoid potential pitfalls.

For example, some programs insert additional
fields into the electronic I-9 requesting information that is not included on
the paper form. This violates regulations because electronic I-9s must have the
same data and elements as the paper form, with no additional content or
language inserted. Other programs require an employee to input his or her
Social Security number, even if the employer does not use E-Verify; this information
is generally necessary only if a company uses E-Verify. And reviews of the
audit trails produced by some systems show a broad disparity in the volume of
information captured, despite the ICE regulations’ requirement for a complete record
of the identity and actions of anyone who has accessed the system.

A compliant electronic I-9 program must include “reasonable controls” to
ensure the system’s “integrity, accuracy and reliability” and to “prevent and
detect the unauthorized or accidental creation of, addition to, alteration of,
deletion of, or deterioration of an electronically completed or stored Form
I-9, including the electronic signature,” according to ICE. It must also be
regularly evaluated to ensure compliance and security.

One feature government officials frequently
inspect in audits is the employee signature process, which has strict
requirements. To protect system security, make certain that only authorized company
representatives have access to electronic I-9 files and that those employees
receive training so that records cannot be accessed by unauthorized personnel
or accidentally altered or erased. As with other electronic data storage, the
I-9 system must provide “for backup and recovery of records to protect against
information loss, such as power interruptions,” ICE regulations state.

If an electronic I-9 platform fails
to meet these standards, even if the I-9 is otherwise fully completed, ICE can determine
that a company has committed a substantive violation, resulting in penalties of
$935 per violation. Even for a small company with 200 employees, the total fine
would add up to $187,000.

Evaluating Systems

If your organization decides to
automate its I-9 process, be thorough in determining whether specific software
is compliant. To protect your organization’s financial interests and reputation,
we recommend that HR professionals adopting automated I-9 systems take the
following actions:

Beware of inexpensive software
add-ons, and closely scrutinize these add-ons
for compliance.

Ensure that your company’s
contract with an electronic I-9 vendor has a favorable indemnification clause
for any fines or litigation that result from the product’s failure to conform
to the electronic I-9 regulations.

Obtain information regarding the
vendor’s financial health to ensure that the indemnification clause can be
enforced and collected on if it becomes necessary.

Review your electronic I-9 system
periodically for compliance with the regulations and developing agency
guidance.

Conduct regular training (at
least once a year) for I-9 administrators to keep their knowledge current.

Assurance that when electronic
records are created, completed or updated, there is a secure and permanent
record created that establishes the date of access, the identity of the
individual who accessed electronic records and a history of the action taken.

Proof that the system can easily produce I-9 paper copies, including
batch and individual copies, as well as any supporting documents.

Taking care to determine the
compliance risks of any automated I-9 software program that your organization
deploys can keep your company from making costly errors and inviting a
government audit—a fate every HR professional wants to avoid.

Members may download one copy of our sample forms and templates for your personal use within your organization. Please note that all such forms and policies should be reviewed by your legal counsel for compliance with applicable law, and should be modified to suit your organization’s culture, industry, and practices. Neither members nor non-members may reproduce such samples in any other way (e.g., to republish in a book or use for a commercial purpose) without SHRM’s permission. To request permission for specific items, click on the “reuse permissions” button on the page where you find the item.